       wrap-json-params
       wrap-keyword-params
       wrap-json-response
-      wrap-anti-forgery
       wrap-session))
 
 (defn -main [& [port]]

  (route GET  "/users/:token/password" users/new-password)
  (route POST "/users/:token/password" users/set-password))

(defmulti render-404
  (fn [req]
    (let [accept (get (:headers req) "accept")]
      (log/debug "accept " accept)
      :json)))

(defmethod render-404 :json
  [req]
  {:status 404
   :headers {"Content-Type" "application/json"}
   :body "{message: \"not found\"}"})

(defmethod render-404 :html
  [req]
  (slurp (io/resource "404.html")))

(defroutes routes
  open-routes
  (friend/logout (POST "/logout" [] (redirect "/")))
  (friend/wrap-authorize protected-routes #{:user})
  (friend/wrap-authorize api-routes #{:user})
  (ANY "*" req
       (do
         (log/debug "unable to match route for " req)
         (route/not-found (render-404 req)))))

(def app
  (-> routes

            [cemerick.friend :as friend]
            [cemerick.friend.workflows :as workflows]
            [cemerick.friend.credentials :as creds]
            [cheshire.core :as json]
            [clj-money.core]
            [clj-money.json]
            [clj-money.middleware :refer [wrap-integer-id-params
